Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

How long must you keep log files under the Cyberbeveiligingswet?

The Cbw and the Cbb name no fixed number of months. You log the events that are relevant to security, determine in advance how long you keep the log files and protect them against unauthorised changes. Choose a period that lets you reconstruct an incident, and do not keep personal data in logs longer than necessary.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Record your ICT systems in Trusq

What the decree asks

You log the events in your systems that are relevant to security, keep the log files for a predetermined period and protect them against unauthorised changes [1]. You monitor relevant events in order to detect, analyse and classify incidents [2].

How you choose the period

For a significant incident you submit, no later than one month after the notification, a final report that includes the root cause [3]. If the incident is still ongoing by then, you submit a progress report at that point and the final report follows within one month of handling [9]. Log files that are kept for less time than you need to discover and investigate an attack do not help with that. Record the chosen period and the reason in your incident handling policy.

Personal data in logs

Logs often contain user names or IP addresses. You keep such personal data no longer than necessary for the purpose [4].

Not to be confused with 60 months

The decree does name a maximum period of 60 months, but it applies to personal data processed by the central contact point, the CSIRT and the minister, not to your own log files [5].

For cloud and IT service providers

These articles do not apply to the digital providers referred to in Article 4 of the decree [6]. The European implementing regulation takes the same starting point for them of a predetermined period [7] and names what the log files contain where appropriate, such as network traffic, changes to users and authentication events [8].

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Per ICT system: Log and monitor security-relevant events in this ICT system to detect incidents. Cbw 21(3)(b), NIS2 21(2)(b)
  • Organisation: Organise incident handling. NIS2 21(2)(b), Cbw 21(3)(b)
  • Organisation: Submit the final incident report. Cbw 29(1)–(2), Cbw 25, NIS2 23(4)(d), NIS2 23(4)(e), Cbb 25
  • Organisation: Provide a progress report when the incident is still ongoing. Cbw 29(2), Cbw 25, NIS2 23(4)(e), Cbb 25

Sources

  1. [1] Cbb Art. 8(6) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Relevant events are logged; log files are kept for a predetermined period and protected against unauthorised changes. Original Dutch text:
    6. De essentiële entiteit of belangrijke entiteit logt de voor de beveiliging van haar netwerk- en informatiesystemen relevante gebeurtenissen in haar netwerk- en informatiesystemen. De entiteit houdt gedurende een vooraf bepaalde periode deze logbestanden bij en beschermt deze tegen ongeautoriseerde wijzigingen.
    Source, retrieved on 3 October 2026.
  2. [2] Cbb Art. 8(3) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). The entity monitors relevant events in order to detect, analyse and classify incidents. Original Dutch text:
    3. De essentiële entiteit of belangrijke entiteit stelt in het kader van de toepassing van het beleid, bedoeld in het eerste lid, processen en procedures vast om relevante gebeurtenissen in haar netwerk- en informatiesystemen te monitoren teneinde incidenten te detecteren, analyseren en classificeren.
    Source, retrieved on 3 October 2026.
  3. [3] Cbw Art. 29(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The final report follows no later than one month after the notification and describes, among other things, the root cause. Original Dutch text:
    1. De essentiële entiteit of belangrijke entiteit dient uiterlijk één maand na de melding, bedoeld in artikel 27, eerste lid, een eindverslag in bij haar CSIRT en haar bevoegde autoriteit waarin het volgende is opgenomen: a. een gedetailleerde beschrijving van het incident, de ernst en de gevolgen ervan; b. het soort bedreiging of de grondoorzaak die waarschijnlijk tot het incident heeft geleid;
    Source, retrieved on 3 October 2026.
  4. [4] GDPR Art. 5(1)(e) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Personal data are not kept longer than necessary for the purpose.
    (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
    Source, retrieved on 3 October 2026.
  5. [5] Cbb Art. 29(1) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). The period of 60 months concerns personal data at the central contact point, the CSIRT and the minister. Original Dutch text:
    1. De persoonsgegevens, niet zijnde de persoonsgegevens, bedoeld in artikel 64, tweede lid, van de wet, die door het centrale contactpunt, het CSIRT en Onze Minister bij of krachtens de wet worden verwerkt, worden niet langer bewaard dan noodzakelijk is ter uitvoering van hun taken op grond van de wet, doch uiterlijk binnen 60 maanden na de eerste verwerking verwijderd.
    Source, retrieved on 3 October 2026.
  6. [6] Cbb Art. 4 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Articles 6 to 18 Cbb do not apply to the digital providers referred to in Article 4 Cbb. Original Dutch text:
    Gelet op artikel 1 van de Uitvoeringsverordening (EU) 2024/2690 zijn de artikelen 6 tot en met 18 niet van toepassing op de volgende essentiële entiteiten en belangrijke entiteiten:
    Source, retrieved on 3 October 2026.
  7. [7] IR 2024/2690, Annex, point 3.2.5 (Implementing Regulation (EU) 2024/2690). Digital providers keep log files for a predetermined period and protect them.
    3.2.5. The relevant entities shall maintain and back up logs for a predefined period and shall protect them from unauthorised access or changes.
    Source, retrieved on 3 October 2026.
  8. [8] IR 2024/2690, Annex, point 3.2.3 (Implementing Regulation (EU) 2024/2690). The implementing regulation names what log files contain where appropriate.
    Where appropriate, logs shall include: (a) relevant outbound and inbound network traffic; (b) creation, modification or deletion of users of the relevant entities’ network and information systems and extension of the permissions; (c) access to systems and applications; (d) authentication-related events;
    Source, retrieved on 3 October 2026.
  9. [9] Cbw Art. 29(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). If the incident is still ongoing when the final report is due, a progress report follows at that point and the final report within one month of handling. Original Dutch text:
    2. Indien het incident nog voortduurt op het moment dat het eindverslag had moeten worden ingediend, dient de essentiële entiteit of belangrijke entiteit op dat moment in plaats van een eindverslag een voortgangsverslag in waarin wordt ingegaan op de aspecten, genoemd in het eerste lid. Zij dient een eindverslag in binnen één maand nadat het incident is afgehandeld.
    Source, retrieved on 7 November 2026.

Related questions

How do you set up incident handling under the Cbw (NIS2 21(2)(b))?What must the final report on an incident contain, and when is it due?When and where do you report a significant incident under the Cbw?Which documents and policies must you have under the Cyberbeveiligingswet?

Next step

Register your organisation and systems such as your TMS, WMS or scanners. Trusq sets up the Cbw measures per system, each with the evidence that is expected and the article it rests on.

Record your ICT systems in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.